Kohntark Virus

Virus Name: Kohntark Aliases: V Status: Rare Discovered: June, 1993 Symptoms: .COM file growth; file date month first digit set to "0"; display of name of a .COM file it is infecting Origin: Sweden or The Netherlands Eff Length: 655 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, AVTK/N, NProt, IBMAV/N, Innoc, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The Kohntark virus was submitted in June, 1993, and is from either Sweden or The Netherlands. Kohntark is a non-resident, direct action virus which infects .COM programs, including COMMAND.COM. It appears to be an earlier version of the K-4B and K-4C viruses. When a program infected with the Kohntark virus is executed, the Kohntark virus will infect one .COM file located in the current directory. The virus will then display the file name of the file it infected. Programs infected with the Kohntark virus will have a file length increase of 655 bytes with the virus being located at the end of the file. The program's date and time will be altered so that the first digit of the file month has been set to "0". The following text strings are encrypted within the Kohntark virus: "*.COM" "????????COM?%" Kohntark doesn't appear to do anything besides replicate. See: K-4B K-4C